Well there's another way to look at it too: the strength of any password-based credential system relies upon the user refusing to give the password to unauthori

Well there's another way to look at it too: the strength of any password-based credential system relies upon the user refusing to give the password to unauthorized parties. The unfortunate consequence of this is that the user must authenticate the system (and verify the security of the connection between) before entering their password. Intel has brilliantly demonstrated a social engineering/phishing attack here. "A street game" on New Yorkers, of all people! http://www.intel.com/content/www/us/en/security/passwordwin-challenge.html http://www.intel.com/content/www/us/en/security/passwordwin-... But the strength estimates they give are far too high: What is the strength of a password which a user is willing to type into a non-https website or computer on the street? Very low.